EDIT

Submitters can access any RegistrationWorkingSet where the registrations are all visible.
Registrations where the submitter is not the Registration.submitter should be hidden though.

The submitter can search for the reference via the "New Registration" view where existing publications can be selected.
. Clicking on "Continue" will get the submitter to the according RegistrationWorkingSetView where unpublished registrations can be visible. Seeing unpublished Registrations is ok as far as the publication has been published in the past!

Conclusion:

1. Unpublished references must be hidden from the select in the "New Registration"
2. RegistrationWorkingSet unpublished references must only be accessible for submitters which have UPDATE permission | which are the creator ?? for this Reference.

Solved among others by implementing the following in RegistrationWorkingSetService:

    public boolean isPermissionDenied(Reference reference) {

        boolean permissionDenied = false;

        if(!checkReferencePublished(reference)){
            permissionDenied = !userHelper.userHasPermission(reference, CRUD.UPDATE);
        }
        return permissionDenied;
    }

    public boolean checkReferencePublished(Reference reference) {
    ...
    }